CVE-2018-12180

Published: Mar 27, 2019Modified: Nov 21, 2024

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Buffer overflow in BlockIo service for EDK II may allow an unauthenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via network access.

Affected (2)

Products: Tianocore: Edk Ii · Opensuse: Leap

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Tianocore Edk Ii	All versions

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 15.0

Related CWEs

CWE-787

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (16)

http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00046.html

Source: secure@intel.com

Mailing ListThird Party Advisory

https://access.redhat.com/errata/RHSA-2019:0809

Source: secure@intel.com

https://access.redhat.com/errata/RHSA-2019:0968

Source: secure@intel.com

https://access.redhat.com/errata/RHSA-2019:1116

Source: secure@intel.com

https://edk2-docs.gitbooks.io/security-advisory/content/buffer-overflow-in-blockio-service-for-ram-disk.html

Source: secure@intel.com

PatchVendor Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ABTDKZK2G5XP6JCO3HXMPOA2NRTIYDZ/

Source: secure@intel.com

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03912en_us

Source: secure@intel.com

https://usn.ubuntu.com/4349-1/

Source: secure@intel.com

http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00046.html